Security Engineering on AWS Course Overview:

Security Engineering on AWS is a three-day, instructor-led classroom course that teaches security practitioners to secure Amazon Web Services (AWS) workloads across the six AWS security domains: identity and access management, infrastructure security, data protection, threat detection, incident response, and governance. Learners work through hands-on labs, instructor demonstrations, and knowledge checks that build from foundational identity and network controls to organization-wide detection, response, and governance. The course also covers protections for generative AI applications and the secure use of GenAI productivity tools. 

After completing Security Engineering on AWS students will be able to:

  • Design and implement secure identity and access management solutions using AWS security best practices and least-privilege principles.
  • Architect and secure AWS infrastructure by applying network security controls, workload protection, and segmentation strategies.
  • Protect sensitive data through encryption, key management, secrets management, and secure data handling practices.
  • Build monitoring, logging, and threat detection solutions to identify and respond to security events across AWS environments.
  • Develop and execute effective incident response and recovery processes, including investigation, containment, and remediation activities.
  • Govern AWS environments at scale using AWS Organizations, AWS Control Tower, compliance services, and security frameworks, while securing Generative AI applications and tools.

Upcoming Batches

Loading Dates...

Key Features of Security Engineering on AWS:

  • Well-structured use-cases to simulate challenges encountered in a Real-World environment

  • Training delivered by Amazon Authorized Instructor (AAI) 

  • Official course material and lab access 

Who Should Attend Security Engineering on AWS:

  • Security engineers
  • Cloud security architects
  • Security operations engineers
  • DevSecOps engineers
  • Security-focused solutions architects
  • IT professionals responsible for securing AWS workloads

Prerequisites for Security Engineering on AWS:

  • Completed AWS Security Essentials (classroom) or AWS Security Fundamentals (digital)  
  • Completed AWS Cloud Practitioner Essentials, or equivalent cloud fundamentals  
  • Working knowledge of networking concepts (TCP/IP, DNS, and firewalls)  
  • Familiarity with the AWS Management Console and the AWS Command Line Interface (AWS CLI) 

Why Choose CloudThat for Security Engineering on AWS Training?

  • Expert Instructors: Learn from AWS Authorized Instructor with extensive industry experience. 
  • Hands-On Learning: Emphasis on practical, hands-on labs and real-world demos to provide participants with valuable, applicable skills. 
  • Post-Training Support: CloudThat offers post-training support, additional resources, and forums for ongoing learning and development. 
  • Enjoy all types of learning modes that suit your requirement virtual, instructor-led classrooms, or hybrid classrooms for Security Engineering on AWS training. 

Learning objective of Security Engineering on AWS:

  • Security Engineering on AWS
  • Architect and troubleshoot infrastructure security controls for network edge services, compute workloads, and network segmentation.  
  • Architect and troubleshoot infrastructure security controls for network edge services, compute workloads, and network segmentation.  
  • Design monitoring, alerting, and logging solutions to detect anomalous activity across an AWS account or organization. 
  • Develop and execute an incident response plan, including forensic artifact capture, containment, eradication, recovery, and root-cause analysis.
  • Govern an AWS environment at scale using AWS Organizations, AWS Control Tower, and compliance services. 
  • Apply protections for generative AI applications and secure the use of GenAI productivity tools. 

Course Outline for Security Engineering on AWS: Download Course Outline

  • Describe the AWS Shared Responsibility Model and how it shifts by service type.
  • Explain defense-in-depth layering across identity, edge, network, compute, and data.
  • Orient to the six AWS security domains and the course build, operate, and govern flow

  • Design identity solutions for human, application, and system authentication with AWS IAM Identity Center, Amazon Cognito, and federation.
  • Configure temporary credentials using AWS STS and IAM Roles Anywhere.
  • Apply multi-factor authentication (MFA) strategies, including mandatory root MFA and phishing-resistant factors.
  • Troubleshoot federated authentication failures using AWS CloudTrail.

Hands-On Lab:

  • Federated access with IAM and multi-factor authentication.

  • Design least-privilege authorization with IAM policies, permission boundaries, and Amazon Verified Permissions
  • Analyze authorization failures using IAM Policy Simulator and IAM Access Analyzer.
  • Remediate unintended permissions and the confused-deputy problem

Hands-On Lab:

  • Least-privilege with ABAC and IAM Access Analyzer.

  • Select edge security strategies based on anticipated threats.
  • Implement layered edge protection with AWS WAF, AWS Shield, and Amazon CloudFront.
  • Configure AWS WAF web ACLs, managed rule groups, and rate-based rules. 
  • Filter outbound DNS with Amazon Route 53 Resolver DNS Firewall.

  • Harden compute workloads with appropriate roles, EC2 Image Builder, and AWS Systems Manager.
  • Implement vulnerability management with Amazon Inspector (including code security) and Amazon GuardDuty.
  • Configure secure administrative access without bastions or SSH keys using AWS Systems Manager Session Manager.
  • Apply generative AI application protections (OWASP Top 10 for LLM Applications) and secure GenAI productivity tools.

  • Design network segmentation with security groups, network ACLs, and AWS Network Firewall.
  • Implement zero-trust application access with AWS Verified Access and Amazon VPC Lattice
  • Identify unintended network reachability with Network Access Analyzer.
  • Secure hybrid connectivity with AWS Site-to-Site VPN and AWS Direct Connect (MACsec).

Hands-on lab: Lab 5

  • Network security controls with AWS WAF and AWS Network Firewall segmentation

  • Enforce encryption for resource connections with ELB security policies and mutual TLS.
  • Manage TLS certificates with AWS Certificate Manager (ACM).
  • Configure private access with AWS PrivateLink and VPC endpoints.
  • Configure inter-resource encryption in transit.

  • Design encryption at rest with AWS KMS and AWS CloudHSM, including the three-layer KMS authorization model.
  • Apply an end-to-end reference architecture for cross-account envelope encryption on Amazon S3.
  • Configure data integrity and lifecycle controls with Amazon S3 Object Lock and S3 Glacier Vault Lock.
  • Configure ransomware-resilient backup with AWS Backup and multi-party approval.
  • Detect sensitive data at rest with Amazon Macie.

Hands-on lab:

  • S3 data security with SSE-KMS, bucket-policy enforcement, replication, and Macie.

  • Manage secrets rotation with AWS Secrets Manager, including RDS-managed credentials
  • Manage imported versus AWS-generated key material and external key stores.
  • Implement data masking with Amazon CloudWatch Logs and Amazon SNS data protection.
  • Implement multi-Region key and certificate management with AWS Private CA.

Hands-on lab

  • Multi-Region AWS KMS rotation, Secrets Manager, and data masking.

  • Identify log sources based on requirements, including AWS CloudTrail, VPC Flow Logs, and network logs.
  • Configure centralized log ingestion into a dedicated logging account and Amazon Security Lake.
  • Analyze and correlate logs with CloudWatch Logs Insights, Amazon Athena, and Amazon OpenSearch Service.

  • Configure workload monitoring and event aggregation across a multi-account organization.
  • Aggregate findings with AWS Security Hub, Security Hub CSPM, Amazon GuardDuty, and Amazon Macie.
  • Create metrics, alerts, and dashboards with Amazon CloudWatch and AWS Config to detect anomalous activity.

Hands-on lab

  • Detection pipeline routing findings to alerts with Amazon EventBridge and Amazon SNS.

  • Diagnose functionality, permissions, and configuration issues in logging pipelines.
  • Remediate common misconfigurations that cause missing logs.

Hands-on lab

  • Centralized logging pipeline and fixing broken logging.

  • Design incident response plans, runbooks, and break-glass access. 
  • Configure services for incident readiness, including AWS Security Incident Response and AWS Shield Advanced.
  • Test incident response effectiveness with security simulations (game days) and GuardDuty event simulation.
  • Capture forensic artifacts from a compromised resource.
  • Validate findings to assess scope and impact
  • Apply containment, eradication, and recovery procedures
  • Perform root-cause analysis with Amazon Detective.
  • Automate the initial incident response with Amazon EventBridge and AWS Lambda.
  • Instructor demonstration: Breach response with Amazon Detective.

Handa-On-Lab

  • Instructor demonstration: Breach response with Amazon Detective.

  • Design multi-account governance with AWS Organizations and AWS Control Tower.
  • Enforce policy at scale with service control policies (SCPs) and resource control policies (RCPs).
  • Evaluate compliance at scale with AWS Config, AWS Firewall Manager, and the AWS Well Architected Tool.
  • Expert Instructors: Learn from AWS Authorized Instructor with extensive industry experience.

Hands-On-Labs

  • Emphasis on practical, hands-on labs and real-world demos to provide participants with valuable, applicable skills.
  • Post-Training Support: CloudThat offers post-training support, additional resources, and forums for ongoing learning and development.
  • Enjoy all types of learning modes that suit your requirement virtual, instructor-led classrooms, or hybrid classrooms for Security Engineering on AWS training

Select Course date

Loading Dates...
Add to Wishlist

Course ID: 13508

Course Price at

Loading price info...
Enroll Now

J
Jay Thadeshwar

Value for money! Had a great experience training with them. Trainers are highly experienced and qualified at the same time the curriculum is quite comprehensive. Great set up for certification training.

S
Suresh B

My experience with CloudThat was very nice. The team is very supportive and trainers and experienced to deliver the content efficiently.

SP
Satya pati

The quality of sessions are awesome. If any one want to getting started with cloud I will refer for cloud that.

This course is ideal for Security Engineers, Security Architects, Cloud Engineers, DevOps professionals, Systems Administrators, and IT professionals responsible for securing AWS workloads and cloud environments. Participants should have a foundational understanding of AWS services and cloud concepts.

By the end of the course, you will be able to design and implement security controls across AWS environments, protect data and identities, detect and respond to security incidents, govern AWS workloads at scale, and apply security best practices for Generative AI applications using AWS services.

Talk to Us